On Thursday, Apple filed its formal legal response to the standoff between it and the Department of Justice.

Last week, Apple CEO Tim Cook again reiterated the company’s firm commitment to privacy and its resolve to fight a new court order issued earlier this month. If the order stands up to legal challenges, Apple would be forced to create a new customized iOS firmware that would remove the passcode lockout on a seized iPhone as part of the ongoing San Bernardino terrorism investigation.

In a call with reporters on Thursday, Apple executives dubbed this customized iOS firmware a "government OS" and added that it would have to make an "FBI forensics lab" at its Cupertino headquarters.

As expected, Apple’s legal arguments rely on its rejection of 1977 Supreme Court decisionUnited States v. New York Telephone, the prominent case that relies on the All Writs Act in which the authorities were demanding the utility to implement a pen register trap and trace device. That obscure 18th-Century law is a catchall statute that the government is relying on for its new order. The All Writs Act essentially allows a judge to order something be done, despite the fact that there's no clear Congressional mandate to follow such an order.

Theodore Boutrous, an Apple lawyer, wrote: "Apple is a private company that does not own or possess the phone at issue, has no connection to the data that may or may not exist on the phone, and is not related in any way to the events giving rise to the investigation. This case is nothing like New York Telephone Co., where there was probable cause to believe that the phone company’s own facilities were 'being employed to facilitate a criminal enterprise on a continuing basis.'"

In the Supreme Court decision for New York Telephone, Justice John Paul Stevens wrote presciently in his 1977 dissent: "If the All Writs Act confers authority to order persons to aid the Government in the performance of its duties, and is no longer to be confined to orders which must be entered to enable the court to carry out its functions, it provides a sweeping grant of authority entirely without precedent in our Nation's history."

“Boundless interpretation”

Further Reading

In its court filing, Apple also argues that the government’s interpretation of the All Writs Act goes too far, fails the previous Supreme Court three-part test, and violates Apple’s First and Fifth Amendment rights.

As Boutrous continues, the All Writs Act does not allow the government to grant itself new authority. Rather, "The Act is intended to enable the federal courts to fill in gaps in the law so they can exercise the authority they already possess by virtue of the express powers granted to them by the Constitution and Congress."

With respect to New York Telephone, the Supreme Court ruled that an All Writs Act order could be granted following a three-part test: the company’s distance, or "remove" from the case; whether the government’s request places an "undue burden" on the company; and whether the company’s assistance was "necessary." Apple takes each of these points head-on.

First, Apple says that unlike New York Telephone, whose phone services were being used to allegedly further a criminal enterprise on an "ongoing basis," the California company has no direct connection to the crime at hand.

Indeed, the company says, "any criminal activity linked to the phone at issue here ended more than two months ago when the terrorists were killed," adding that "Apple is no more connected to this phone than General Motors is to a company car used by a fraudster on his daily commute."

Second, Apple argues that yes, in fact, forcing it to conscript "six to 10" engineers who would work on this project for weeks or months—which may be multiplied should further orders come in from other prosecutors—does constitute an "undue burden."

"One of the most logical arguments for Apple is the burdensome nature of the government's request," Brian Owsley, a former federal magistrate judge, who is now a law professor at the University of North Texas, e-mailed Ars. "The All Writ Act is not supposed to apply where the request is too burdensome. Essentially, Apple is being asked to do something that has not yet been required, which is to create a code that it has not developed as opposed to provide existing codes"

Unlike in New York Telephone, where the government asked for a pen register—something the telco already did as part of its regular course of business—Apple argues that marshalling these resources would be overly burdensome.

Creating the ability to enter passcodes into a device electronically with no software-imposed delays would entail modifying existing code to remove delays as well as writing new code that manages a connection to another device and, using a communications protocol that would also have to be designed, allows the other device to submit test passcodes and receive and process the result of those tests. The means for establishing such connection could include Wi-Fi, Bluetooth, or direct cable connection.

Apple will also need to either (1) develop and prepare detailed documentation for the above protocol to enable the FBI to build a brute-force tool that is able to interface with the device to input passcode attempts, or (2) design, develop and prepare documentation for such a tool itself. Further, if the tool is utilized remotely (rather than at a secure Apple facility), Apple will also have to develop procedures to encrypt, validate, and input into the device communications from the FBI.

In its earlier filing, the government maintained that this is merely a one-off request, which could be destroyed after the San Bernardino investigation closes.

Further Reading

But Apple doesn’t buy it: "This enormously intrusive burden—building everything up and tearing it down for each demand by law enforcement—lacks any support in the cases relied on by the government, nor do such cases exist."

Did the FBI ask any other government agency for help?

Crucially, the third part of this test relies on the question of "necessity." This part of Apple’s argument explicitly points out that the government has not made use of all of the tools at its disposal, such as employing the resources of other government agencies that may be better equipped at such a task.

Here, by contrast, the government has failed to demonstrate that the requested order was absolutely necessary to effectuate the search warrant, including that it exhausted all other avenues for recovering information. Indeed, the FBI foreclosed one such avenue when, without consulting Apple or reviewing its public guidance regarding iOS, the government changed the iCloud password associated with an attacker’s account, thereby preventing the phone from initiating an automatic iCloud back-up. See supra II.C. Moreover, the government has not made any showing that it sought or received technical assistance from other federal agencies with expertise in digital forensics, which assistance might obviate the need to conscript Apple to create the back door it now seeks.

Apple also makes smaller, but clear-cut arguments that the judicial order violates its constitutional rights. According to its lawyers, Apple has a First Amendment right to not be forced to speak by the government. Because courts have established that software code is speech, any code it would be forced to write would constitute compelled speech.

But more interesting—and as Ars predicted—Apple also more strongly relies on its Fifth Amendment claims.

As Ars wrote previously, for the general public, the Fifth Amendment is best known for the privilege against compelled self-incrimination. It's the amendment invoked by Martin Shkreli, the Big Pharma bad boy who is at the center of a securities fraud investigation and is refusing to assist Congress in probing pharmaceutical prices.

But the Fifth Amendment goes beyond the well-known right against compelled self-incrimination. The relevant part for the Apple analysis is: "nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation." The idea here is that the government is conscripting Apple to build something that it doesn't want to do—this conscription is allegedly a breach of its "substantive due process."

As Apple's counsel concluded:

In addition to violating the First Amendment, the government’s requested order, by conscripting a private party with an extraordinarily attenuated connection to the crime to do the government’s bidding in a way that is statutorily unauthorized, highly burdensome, and contrary to the party’s core principles, violates Apple’s substantive due process right to be free from "‘arbitrary deprivation of [its] liberty by government.’"

If you give a mouse a cookie…

Further Reading

Apple lawyers also note that if the government’s order is allowed to stand, there is nothing stopping federal or local authorities from conscripting the company to do other things besides simply break a digital lock.

Finally, given the government’s boundless interpretation of the All Writs Act, it is hard to conceive of any limits on the orders the government could obtain in the future. For example, if Apple can be forced to write code in this case to bypass security features and create new accessibility, what is to stop the government from demanding that Apple write code to turn on the microphone in aid of government surveillance, activate the video camera, surreptitiously record conversations, or turn on location services to track the phone’s user? Nothing.

"Apple is exactly right to draw attention to the boundless nature of what the government wants," Andrew Crocker, an attorney with the Electronic Frontier Foundation, told Ars.

"It can't in one breath claim this is just about one phone but suggest that the All Writs Act places no limits on how much tech companies can be compelled to reengineer their products. You can expect to see these arguments, particularly the constitutional ones, be developed further in the amicus briefs supporting Apple."

Indeed, Rep. Ted Lieu (D-Calif.), a freshman congressman who has been closely following this case, told Ars by phone that prosecutors and the FBI should withdraw the motion to compel, and allow the American people and Congress to decide the outcome.

"This is not just about Apple," he said. "This is about what can the government can do to coerce a private citizen or company to take extraordinary actions in support of the government—there is no limit. What's to keep the government from ordering Amazon to write new software that will notify the government when their customers order books that might make them suspicious? It allows the government to turn anyone into an arm of law enforcement, and that is what is at stake here."

The Justice Department, for its part, released a statement after the new Apple court filing, putting the blame squarely on Apple.

“The Justice Department’s approach to investigating and prosecuting crimes has remained the same; the change has come in Apple’s recent decision to reverse its long-standing cooperation in complying with All Writs Act orders," Melanie Newman, a DOJ spokeswoman, wrote.

"Law enforcement has a longstanding practice of asking a court to require the assistance of a third-party in effectuating a search warrant," she continued. "When such requests concern a technological device, we narrowly target our request to apply to the individual device. In each case, a judge must review the relevant information and agree that a third party’s assistance is both necessary and reasonable to ensure law enforcement can conduct a court-authorized search. Department attorneys are reviewing Apple’s filing and will respond appropriately in court."

Thom Mrozek, a spokesman for the US Attorney in Los Angeles, refused to answer Ars' specific questions as to whether the FBI had sought or received technical assistance from the National Security Agency or any other intelligence agency in this case.

The government's reply is due March 10, and Apple will be allowed again to respond by March 15.

A federal court hearing has been scheduled for March 22 in Riverside, California to address Apple’s legal challenges, which Ars will attend.

Share this story

Cyrus Farivar
Cyrus is a Senior Tech Policy Reporter at Ars Technica, and is also a radio producer and author. His latest book, Habeas Data, about the legal cases over the last 50 years that have had an outsized impact on surveillance and privacy law in America, is out now from Melville House. He is based in Oakland, California. Emailcyrus.farivar@arstechnica.com//Twitter@cfarivar

* The All Writs Act Does Not Grant Authority To Compel Assistance Where Congress Has Considered But Chosen Not To Confer Such Authority.

* New York Telephone Co. And Its Progeny Confirm That The All Writs Act Does Not Authorize Courts To Compel The Unprecedented And Unreasonably Burdensome Conscription Of Apple That The Government Seeks

* The First Amendment Prohibits The Government From Compelling Apple To Create Code

* The Fifth Amendment’s Due Process Clause Prohibits The Government From Compelling Apple To Create The Request Code

The second bullet point has some interesting arguments specifically:a) Apple’s Connection To The Underlying Case Is “Far Removed” And Too Attenuated To Compel Its Assistanceb) The Order Requested By The Government Would Impose An Unprecedented And Oppressive Burden On Apple And Citizens Who Use The iPhone. c) The Government Has Not Demonstrated Apple’s Assistance Was Necessary To Effectuating The Warrant.

At some level, I can almost believe that the FBI genuinely thinks Apple is "overreacting" to their request, and that at least some of them truly want to pursue every loose end possible. That doesn't mean I agree with them; even if every single individual currently at the FBI was genuinely interested in this for the data on the phone, and not the precedent it sets, there's nothing to guarantee that individuals in the future don't use this precedent to cause more harm.

It's too hard to ensure that only the FBI (who we all know would be perfect, saintly custodians of this code) has access to this, and the precedent is too dangerous. Good luck to Apple!

Apple is taking a 1st and 5th amendment defense in their filing. If this works and they win on those grounds (at a Supreme Court level), it would be a massive win for security and civil liberties. Winning on a 1st and 5th basis means we won't see any laws forcing companies to design government friendly systems. FBI would much rather see Apple win on a much more narrow basis (such as the courts rejecting AWA as a means to force Apple to comply) so a law can be drafted forcing the hand of Apple and others. This is going to be one hell of a showdown folks.

Is it just me, or is Apple being a bit disingenuous here? Apple argued in 2010 that you can't legally hack your own iPhone because Apple technically owns the OS and you are just a user (an argument that that lost, but on the basis of the applicability of copyright law to that situation, not on the basis of any question of Apple's ownership of the copyright), but now that Apple is asked to hack it, they are claiming that they don't own it either...

So you're saying that they can't change their minds in 6 years' time? Honestly, though, I don't see the conflict. Apple says that end users don't have the right to crack the digital protections at play in their code. Much as I disagree with the law, they actually have the DMCA on their side in that one. This, however, is different from that. The government is asking for a new OS to be created with several critical protections stripped out, then to have that OS pushed to the device so that they may unlock it by a brute force mechanism. That's wildly different from an end user "hacking" their iPhones.

Apple is taking a 1st and 5th amendment defense in their filing. If this works and they win on those grounds (at a Supreme Court level), it would be a massive win for security and civil liberties. Winning on a 1st and 5th basis means we won't see any laws forcing companies to design government friendly systems. FBI would much rather see Apple win on a much more narrow basis (such as the AWA) so a law can be drafted forcing the hand of Apple and others. This is going to be one hell of a showdown folks.

We'll still see those laws. And they will have to be beat back too. Precedent and the Constitution do not stop state and federal legislators from passing bad law. It happens all the time.

Is it just me, or is Apple being a bit disingenuous here? Apple argued in 2010 that you can't legally hack your own iPhone because Apple technically owns the OS and you are just a user (an argument that that lost, but on the basis of the applicability of copyright law to that situation, not on the basis of any question of Apple's ownership of the copyright), but now that Apple is asked to hack it, they are claiming that they don't own it either...

Is it just me, or is Apple being a bit disingenuous here? Apple argued in 2010 that you can't legally hack your own iPhone because Apple technically owns the OS and you are just a user (an argument that that lost, but on the basis of the applicability of copyright law to that situation, not on the basis of any question of Apple's ownership of the copyright), but now that Apple is asked to hack it, they are claiming that they don't own it either...

I see it as the difference between "We CAN make changes to your iPhone" and "We MUST make changes to your iPhone".

[quote="[url=http://arstechnica.com/civis/viewtopic.php?p=30720199#p30720199]Winning on a 1st and 5th basis means we won't see any laws forcing companies to design government friendly systems.[/quote]Well, not really, no. The real concern here is that the FBI will use an Apple win on those grounds to go on to craft specific legislation that requires such actions. CALEA, for example, forced all telcos to have system access mechanisms in place for law enforcement to use. Now, CALEA also states that if the telco doesn't have the key to decrypt data then they can't be forced to break it, but at the same time if they craft an encryption mechanism and do have the keys, they can be forced to decrypt the data for law enforcement. So it's kind of a double-edged sword there.

But very finely tuned legislation could probably bypass some of the concerns here by mandating that all OEMs much have such software as the feds are asking for here as a matter of law. I suppose it's possible there may be arguments that this would also be forcing something but there is at least some precedent for requiring certain access be provided.

Is it just me, or is Apple being a bit disingenuous here? Apple argued in 2010 that you can't legally hack your own iPhone because Apple technically owns the OS and you are just a user (an argument that that lost, but on the basis of the applicability of copyright law to that situation, not on the basis of any question of Apple's ownership of the copyright), but now that Apple is asked to hack it, they are claiming that they don't own it either...

So you're saying that they can't change their minds in 6 years' time? Honestly, though, I don't see the conflict. Apple says that end users don't have the right to crack the digital protections at play in their code. Much as I disagree with the law, they actually have the DMCA on their side in that one. This, however, is different from that. The government is asking for a new OS to be created with several critical protections stripped out, then to have that OS pushed to the device so that they may unlock it by a brute force mechanism. That's wildly different from an end user "hacking" their iPhones.

I think the point is that one of Apple's arguments is specifically that "Apple’s Connection To The Underlying Case Is 'Far Removed' And Too Attenuated To Compel Its Assistance". Specifically that once sold Apple no longer has an ownership interest in the product and thus the compelling of assistance is too long of a reach. Apples claim here is that even if the AWA could compel this type of behavior generally speaking it can't here because Apple is "far removed" from the device in question. Honestly I think the prior poster is correct. The govt has to refute each of these arguments and for this one their counter argument is going to be that Apple does control the IOS and thus it is not "Far Removed". Apple's prior claims regarding its ownership of IOS even on user devices as it related to jailbreaking will be used against Apple.

Note to be clear I believe Apple is in the right but Apple's past claims do undermine this specific defense. Luckily Apple is looking to attack the order using multiple arguments so they can lose most of them and still win the case. Sadly I can't see Apple's prior attacking of jailbreaking to be anything but a liability in this particular argument.

This seems like a big misdirection to me to make people think the data on their phone is safe. The opposite of what Snowden says to make the public believe things have changed. How could Apple get away with selling iPhones in China without being able to access the data? Wasn't a backdoor a concession Apple had to make in that country? The additional phones the government wants unlocked just goes along with the story. It's all theater!

Has anyone like a Snowden confirmed the phones are indeed completely locked down?

The problem is not that they are completely locked down and free from security bugs it is that they wipe clean and brick if you trie to circumvent the security by brute forcing passcode or if it does't trust it's own hardware. That is a completely reasonable feature. If you lose your phone and dot want strangers in your private stuff but is seems bad for the FBI apparently because of the risk of destroying the information they are after.

Who knew that changing nMaxFailBeforeWipe=10 to nMaxFailBeforeWipe=100000000 was so hard? Or even simply commenting out nMaxFailBeforeWipe++; was so hard?

I understand Apple's unwillingness to comply and I strongly support them for it but... Seriously? Coding around a 10 failure limit is trivial.

Where did Apple say otherwise? Apple's claim that this is an undue burden has nothing to do with the technical requirements of changing the code.

Also it is far more than just updating a couple lines because they can't replace the OS without user passcode. Despite some pretty sloppy explanations in the news, what the FBI wants Apple to do is design an in memory environment which can brute force the PIN without restrictions.

I'm going to laugh when the FBI end up losing this case, then magically the NSA manage to crack it and suddenly all reports are going to stop cause they found nothing on the phone besides Flappy Bird

This was one of the terrorists work issued phone. Before the attack they destroyed their personal phones and computers. Likely there isn't anything incriminating in the 5C. FBI probably is more interested in using this attack as it is the perfect excuse to create a precedent

I've maintained for several years now that a "Balkanization" of the Internet is inevitable because of security concerns. This is still a world of sovereign nations where multinationals need to comply with local laws (theoretically, of course). If US law says that a US-based company needs to do something then guess what - it needs to do it. Either change the law or change the company's domicile.

On the other hand, if you're really concerned about privacy the Turing Phone looks interesting. Wouldn't be surprised if the international security agencies are already keeping a close eye on whoever's signing up to buy those things, though.

See the issue with that is this. If the USA says you need to install a backdoor in your software, and you comply, China is going to come up and demand access as well or else they're going to forbid you from doing business. Or they'll just block Apple from doing business in China since they just gave the USA government access to their citizens data.

If US law says that a US-based company needs to do something then guess what - it needs to do it.

Apple's claim is that existing US law doesn't require them to "do it". No new law was passed. The FBI simply decided to take a rather tortured interpretation of an existing law. Apple disagrees and now they are in court.

Also if there was a law which mandated backdoors simply changing the company domicile would be pointless. If the law said you must have a backdoor and the iPhone 13 didn't have one then it would be unlawful to import the iPhone in the US.